A copied router configuration creates two response problems. One is the compromised device. The other is every credential, trusted source, and management path described inside the file.
Rebuilding the router addresses the first problem. It does not automatically contain the second.
That distinction matters in the activity described by the joint router-security advisory released July 13, 2026. The participating agencies attributed the campaign to actors associated with Center 16 of Russia's Federal Security Service.
The reported technique is not especially exotic. The actors scan for routers that accept legacy SNMP, try weak or default community strings, and issue SNMP Set requests that invoke supported configuration-copy functions. The router then transfers its own configuration, typically over TFTP, to external infrastructure.
There may be no implant or suspicious process chain to find. A legitimate management function performs the export.
The file changes the containment boundary
A router configuration can contain local credentials, SNMP community strings, management addresses, access-control rules, routes, interface descriptions, neighboring systems, and trusted source addresses.
Not every item is a reusable secret. The collection still has operational value.
Routes and interface descriptions help map the environment. Access-control rules identify permitted sources. Management settings point toward monitoring, authentication, and administrative systems. Even strongly protected passwords do not hide those relationships.
The FBI has documented both configuration collection and further activity in this campaign. In an August 2025 warning, it reported that Center 16 actors had collected configurations from thousands of networking devices associated with US critical-infrastructure entities during the preceding year.
On some vulnerable devices, the actors modified configurations to enable unauthorized access. They used that access for reconnaissance that revealed interest in protocols and applications associated with industrial control systems.
The FBI did not say that every collected configuration contained reusable credentials. It also did not establish that each collection event led to deeper access. It did document configuration collection, device modification, and downstream reconnaissance within the same campaign.
That is enough to make a router rebuild an incomplete containment decision.
Rotation is a dependency problem
The difficult question is not whether a credential exposed in the file should be changed. It is how far that change must extend.
A shared SNMP community string may be accepted by an entire device class. A reused local administrator credential may work across sites. A management server address may appear in many allowlists. The NCSC's router guidance pairs management-source allowlists with boundary anti-spoofing so a trusted source cannot simply be impersonated from outside the network.
Rotating everything immediately can disrupt monitoring, automation, backups, and emergency access. Rotating only the affected router can leave the attacker with valid access elsewhere.
A practical response starts by separating four questions:
- Was a configuration exported, and where was it sent?
- Which credentials or shared secrets were present in that version of the configuration?
- Where else were those credentials or trust relationships accepted?
- What changed on the router or adjacent management systems?
The third question is where inventory quality becomes incident-response capability. If the team cannot identify every device that accepts a community string or local account, it cannot confidently describe the remaining exposure.
Detection has the same dependency issue
The advisory supplies example Cisco object identifiers for configuration-copy monitoring. One identifies the ccCopy subtree. Another identifies a destination server address.
The cited destination-address object, ccCopyServerAddress, is deprecated and limited to IPv4. Newer implementations can use ccCopyServerAddressType and ccCopyServerAddressRev1.
An exact-match detector built only from the two examples can therefore miss a valid transaction using the replacement address object. Prefix matching on the ccCopy subtree, combined with monitoring for SNMP Set requests, covers that case.
Outbound controls are part of the same detection model. If a router can initiate arbitrary TFTP transfers, the configuration-copy function already has an exit path. External TFTP should be blocked unless it is operationally required, then closely monitored where it cannot be blocked.
Device logs also need to exist somewhere other than the device. A compromised router should not be the only custodian of evidence about its own management activity.
SNMPv3 is necessary, but scope still matters
The joint advisory and the NSA's guidance on reducing SNMP abuse recommend SNMPv3 with authPriv, which adds authentication and encryption.
NSA also states that SNMPv3 alone is insufficient. A compromised or over-privileged SNMPv3 credential can still reach sensitive objects unless its permissions are constrained.
The stronger design separates read and write authority, limits accessible objects through MIB views, restricts management traffic to approved systems, separates the management network where practical, monitors configuration-copy operations, and blocks unnecessary outbound management protocols.
Where older equipment or management software cannot support authPriv, NSA identifies authNoPriv as the fallback but still directs operators to upgrade.
The immediate inventory is therefore broader than a list of legacy SNMP versions. It also needs to show where management credentials are reused, which systems can issue write operations, and which destinations the infrastructure itself can reach.
For teams supporting mixed generations of network equipment, the unresolved tradeoff is sequencing. If configuration history is uncertain and the credential inventory is incomplete, do you rotate shared credentials across the reachable device class immediately and accept the outage risk, or contain management traffic first while building the reuse map?
That decision belongs in the incident runbook before a router exports its own configuration.